Key points
- Since the end of March 2021, businesses have had to bring their cookie policy into line with the GDPR and the ePrivacy Directive.
- The GDPR governs data processing in the European Union; the ePrivacy Directive supplements it for electronic communications.
- Continuing to browse no longer counts as consent: the user must consent to cookies through a clear affirmative action.
- Refusing cookies must be as easy as accepting them, and the user must be able to change their mind easily.
- The user must be informed of the purpose of the collection, the list of partners and the consequences of refusing or accepting.
- Three types of cookies are affected: statistics, functionality and advertising.
From the end of March 2021, businesses have had to bring themselves into compliance with the requirements of the GDPR and the ePrivacy Directive on cookie policies.
HASHTAG Avocats, your law firm, sets out the changes you need to make to comply with the requirements of the GDPR and the ePrivacy Directive.
As a reminder, the GDPR is a European regulation that governs data processing uniformly throughout the European Union. The ePrivacy Directive supplements the GDPR and applies to the electronic communications sector.
In line with the requirements of the GDPR of May 2018, businesses must display consent management tools on their website, in particular for the placing of cookies. However, the regulation was too open to interpretation.
Some websites took the view that simply continuing to browse amounted to consent to cookies. Other websites did not collect their users’ consent at all.
To remedy these differing interpretations and clarify the position, the CNIL (French data protection authority) adopted new guidelines (deliberation No. 2020-091 of 17 September 2020) and a recommendation (deliberation No. 2020-092 of the same day), which provide in particular that:
- Continuing to browse or scrolling down the page no longer counts as consent. The user must consent to cookies through a clear affirmative action, for example by clicking “I accept”; failing that, the user is deemed to have refused.
- The user must be able to refuse cookies just as easily. The user must also be able to change their mind easily.
- Until then, some websites did not allow users to express their choice as easily. In particular, refusing consent was not as simple as accepting. To refuse, or even to express reservations, the user had to open a specific tab such as “find out more”.
- Under these guidelines, users must be fully informed of how their data will be used. The purpose of the collection must be stated, together with the list of partners who will use the data and the consequences of refusing or accepting the trackers.
The CNIL set the end of March 2021 as the latest deadline for compliance with these new rules.
These rules have practical consequences, especially for websites that relied on consent through continued browsing: trackers that require consent may only concern users who have given it, which can reduce the volume of data collected.
Which data is affected by compliance with the GDPR and the ePrivacy Directive?
From the end of March 2021, three types of cookies are particularly affected:
1. “Statistics” (or performance) cookies make it possible to analyse a website’s traffic and performance. In principle, they may only be placed with the user’s consent. One nuance applies: according to the CNIL guidelines, trackers whose purpose is strictly limited to audience measurement, solely on behalf of the publisher, are exempt from consent, subject to the conditions the CNIL sets out.
2. Functionality cookies make it possible to personalise the user experience by suggesting products already viewed. Without these cookies, the user journey is harder to make smooth.
3. Advertising cookies, placed by advertisers or advertising networks (régies), make it possible in particular to measure the sales generated by an advertising campaign. Without them, an advertising network finds it harder to demonstrate its effectiveness.
Players whose business model relies on data collection, such as media outlets or price comparison sites, are particularly affected.
An audit of websites and mobile applications makes it possible to identify the actions needed to meet the regulatory requirements.
